CVE-2026-14239: Unknown Tourmaster

High severity, CVSS 7.1. EPSS: 0.1% chance of exploitation in the next 30 days.

The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken from a request parameter, and does not escape that label when echoing it on the filter admin page, allowing an unauthenticated attacker to trick a logged-in administrator into storing JavaScript that then executes in the admin area (stored Cross-Site Scripting via CSRF).

Affected products

• Unknown Tourmaster: before 5.4.8 (fixed in 5.4.8)

Published 2026-07-30. Last modified 2026-08-04.